Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-0793GHSA-H7WQ-JJ8R-QM7PGO-2024-3277

Kube-controller-manager: malformed hpa v1 manifest causes crash

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 1.27, 1.27.0-alpha.1
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • kube-controller-manager

    fixed in 1.27

  • baremetal-machine-controller-container

    Version range not reported

  • cluster-etcd-operator-container

    Version range not reported

  • cluster-monitoring-operator-container

    Version range not reported

  • cluster-network-operator-container

    Version range not reported

  • cluster-node-tuning-operator-container

    Version range not reported

  • cluster-version-operator-container

    Version range not reported

  • configmap-reload-container

    Version range not reported

  • coredns-container

    Version range not reported

  • csi-attacher-container

    Version range not reported

  • csi-driver-manila-container

    Version range not reported

  • csi-driver-manila-operator-container

    Version range not reported

  • csi-driver-nfs-container

    Version range not reported

  • csi-livenessprobe-container

    Version range not reported

  • csi-node-driver-registrar-container

    Version range not reported

  • csi-provisioner-container

    Version range not reported

  • driver-toolkit-container

    Version range not reported

  • ibm-vpc-node-label-updater-container

    Version range not reported

  • ironic-rhcos-downloader-container

    Version range not reported

  • kube-proxy-container

    Version range not reported

  • kube-rbac-proxy-container

    Version range not reported

  • kube-state-metrics-container

    Version range not reported

  • marketplace-operator-container

    Version range not reported

  • multus-cni-container

    Version range not reported

  • oauth-server-container

    Version range not reported

  • oc-mirror-plugin-container

    Version range not reported

  • openshift-enterprise-cli-container

    Version range not reported

  • openshift-enterprise-console-container

    Version range not reported

  • openshift-enterprise-console-operator-container

    Version range not reported

  • openshift-enterprise-deployer-container

    Version range not reported

  • openshift-enterprise-haproxy-router-container

    Version range not reported

  • openshift-enterprise-hyperkube-container

    Version range not reported

  • openshift-enterprise-keepalived-ipfailover-container

    Version range not reported

  • openshift-enterprise-pod-container

    Version range not reported

  • openshift-enterprise-registry-container

    Version range not reported

  • openshift-enterprise-tests-container

    Version range not reported

  • openshift-state-metrics-container

    Version range not reported

  • operator-lifecycle-manager-container

    Version range not reported

  • operator-registry-container

    Version range not reported

  • ose-agent-installer-api-server-container

    Version range not reported

  • ose-agent-installer-csr-approver-container

    Version range not reported

  • ose-agent-installer-node-agent-container

    Version range not reported

  • ose-agent-installer-orchestrator-container

    Version range not reported

  • ose-alibaba-cloud-controller-manager-container

    Version range not reported

  • ose-alibaba-cloud-csi-driver-container

    Version range not reported

  • ose-alibaba-disk-csi-driver-operator-container

    Version range not reported

  • ose-alibaba-machine-controllers-container

    Version range not reported

  • ose-apiserver-network-proxy-container

    Version range not reported

  • ose-aws-cloud-controller-manager-container

    Version range not reported

  • ose-aws-cluster-api-controllers-container

    Version range not reported

  • ose-aws-ebs-csi-driver-container

    Version range not reported

  • ose-aws-ebs-csi-driver-operator-container

    Version range not reported

  • ose-aws-pod-identity-webhook-container

    Version range not reported

  • ose-azure-cloud-controller-manager-container

    Version range not reported

  • ose-azure-cloud-node-manager-container

    Version range not reported

  • ose-azure-cluster-api-controllers-container

    Version range not reported

  • ose-azure-disk-csi-driver-container

    Version range not reported

  • ose-azure-disk-csi-driver-operator-container

    Version range not reported

  • ose-azure-file-csi-driver-container

    Version range not reported

  • ose-azure-file-csi-driver-operator-container

    Version range not reported

  • ose-baremetal-installer-container

    Version range not reported

  • ose-baremetal-operator-container

    Version range not reported

  • ose-baremetal-runtimecfg-container

    Version range not reported

  • ose-cli-artifacts-container

    Version range not reported

  • ose-cloud-credential-operator-container

    Version range not reported

  • ose-cloud-network-config-controller-container

    Version range not reported

  • ose-cluster-api-container

    Version range not reported

  • ose-cluster-authentication-operator-container

    Version range not reported

  • ose-cluster-autoscaler-operator-container

    Version range not reported

  • ose-cluster-baremetal-operator-container

    Version range not reported

  • ose-cluster-bootstrap-container

    Version range not reported

  • ose-cluster-capi-operator-container

    Version range not reported

  • ose-cluster-cloud-controller-manager-operator-container

    Version range not reported

  • ose-cluster-config-operator-container

    Version range not reported

  • ose-cluster-control-plane-machine-set-operator-container

    Version range not reported

  • ose-cluster-csi-snapshot-controller-operator-container

    Version range not reported

  • ose-cluster-dns-operator-container

    Version range not reported

  • ose-cluster-image-registry-operator-container

    Version range not reported

  • ose-cluster-ingress-operator-container

    Version range not reported

  • ose-cluster-kube-apiserver-operator-container

    Version range not reported

  • ose-cluster-kube-cluster-api-operator-container

    Version range not reported

  • ose-cluster-kube-controller-manager-operator-container

    Version range not reported

  • ose-cluster-kube-scheduler-operator-container

    Version range not reported

  • ose-cluster-kube-storage-version-migrator-operator-container

    Version range not reported

  • ose-cluster-machine-approver-container

    Version range not reported

  • ose-cluster-openshift-apiserver-operator-container

    Version range not reported

  • ose-cluster-openshift-controller-manager-operator-container

    Version range not reported

  • ose-cluster-ovirt-csi-operator-container

    Version range not reported

  • ose-cluster-platform-operators-manager-container

    Version range not reported

  • ose-cluster-policy-controller-container

    Version range not reported

  • ose-cluster-storage-operator-container

    Version range not reported

  • ose-cluster-update-keys-container

    Version range not reported

  • ose-containernetworking-plugins-container

    Version range not reported

  • ose-csi-driver-shared-resource-container

    Version range not reported

  • ose-csi-driver-shared-resource-operator-container

    Version range not reported

  • ose-csi-driver-shared-resource-webhook-container

    Version range not reported

  • ose-csi-external-resizer-container

    Version range not reported

  • ose-csi-external-snapshotter-container

    Version range not reported

  • ose-csi-snapshot-controller-container

    Version range not reported

  • ose-csi-snapshot-validation-webhook-container

    Version range not reported

  • ose-egress-router-cni-container

    Version range not reported

  • ose-etcd-container

    Version range not reported

  • ose-gcp-cloud-controller-manager-container

    Version range not reported

  • ose-gcp-cluster-api-controllers-container

    Version range not reported

  • ose-gcp-pd-csi-driver-container

    Version range not reported

  • ose-gcp-pd-csi-driver-operator-container

    Version range not reported

  • ose-hypershift-container

    Version range not reported

  • ose-ibmcloud-cluster-api-controllers-container

    Version range not reported

  • ose-ibm-cloud-controller-manager-container

    Version range not reported

  • ose-ibmcloud-machine-controllers-container

    Version range not reported

  • ose-ibm-vpc-block-csi-driver-container

    Version range not reported

  • ose-ibm-vpc-block-csi-driver-operator-container

    Version range not reported

  • ose-image-customization-controller-container

    Version range not reported

  • ose-insights-operator-container

    Version range not reported

  • ose-installer-artifacts-container

    Version range not reported

  • ose-installer-container

    Version range not reported

  • ose-kube-storage-version-migrator-container

    Version range not reported

  • ose-kubevirt-cloud-controller-manager-container

    Version range not reported

  • ose-kubevirt-csi-driver-container

    Version range not reported

  • ose-libvirt-machine-controllers-container

    Version range not reported

  • ose-machine-api-operator-container

    Version range not reported

  • ose-machine-api-provider-aws-container

    Version range not reported

  • ose-machine-api-provider-azure-container

    Version range not reported

  • ose-machine-api-provider-gcp-container

    Version range not reported

  • ose-machine-api-provider-openstack-container

    Version range not reported

  • ose-machine-config-operator-container

    Version range not reported

  • ose-machine-os-images-container

    Version range not reported

  • ose-multus-admission-controller-container

    Version range not reported

  • ose-multus-networkpolicy-container

    Version range not reported

  • ose-must-gather-container

    Version range not reported

  • ose-network-interface-bond-cni-container

    Version range not reported

  • ose-network-metrics-daemon-container

    Version range not reported

  • ose-network-tools-container

    Version range not reported

  • ose-node-container

    Version range not reported

  • ose-nutanix-cloud-controller-manager-container

    Version range not reported

  • ose-nutanix-machine-controllers-container

    Version range not reported

  • ose-oauth-apiserver-container

    Version range not reported

  • ose-olm-rukpak-container

    Version range not reported

  • ose-openshift-apiserver-container

    Version range not reported

  • ose-openshift-controller-manager-container

    Version range not reported

  • ose-openstack-cinder-csi-driver-container

    Version range not reported

  • ose-openstack-cinder-csi-driver-operator-container

    Version range not reported

  • ose-openstack-cloud-controller-manager-container

    Version range not reported

  • ose-ovirt-csi-driver-container

    Version range not reported

  • ose-ovirt-machine-controllers-container

    Version range not reported

  • ose-ovn-kubernetes-container

    Version range not reported

  • ose-powervs-block-csi-driver-container

    Version range not reported

  • ose-powervs-block-csi-driver-operator-container

    Version range not reported

  • ose-powervs-cloud-controller-manager-container

    Version range not reported

  • ose-powervs-machine-controllers-container

    Version range not reported

  • ose-prometheus-adapter-container

    Version range not reported

  • ose-route-controller-manager-container

    Version range not reported

  • ose-service-ca-operator-container

    Version range not reported

  • ose-thanos-container

    Version range not reported

  • ose-tools-container

    Version range not reported

  • ose-vmware-vsphere-csi-driver-container

    Version range not reported

  • ose-vmware-vsphere-csi-driver-operator-container

    Version range not reported

  • ose-vsphere-cloud-controller-manager-container

    Version range not reported

  • ose-vsphere-cluster-api-controllers-container

    Version range not reported

  • ose-vsphere-problem-detector-container

    Version range not reported

  • ovn-kubernetes-microshift-container

    Version range not reported

  • prometheus-config-reloader-container

    Version range not reported

  • prometheus-operator-admission-webhook-container

    Version range not reported

  • prometheus-operator-container

    Version range not reported

  • telemeter-container

    Version range not reported

  • vmware-vsphere-syncer-container

    Version range not reported

  • openshift

    Version range not reported

  • microshift

    Version range not reported

  • k8s.io/kubernetesGo

    fixed in 1.27.0-alpha.1

References 5

access.redhat.com

bugzilla.redhat.com

GitHub · openshift/kubernetes